Multivariate Security Breach Probability: The Gordon-Loeb Model with Copulas

In this paper we introduce multivariate extensions of the well known Gordon and Loeb (2002) model (GL since now on). The GL model is based on a bivariate Security Breach Probability (SBP) function, whose arguments are the probability of success of an external attack and an investment in security that is decreasing that probability of success. Here we discuss two main directions concerning the multivariate extension of the model. The most obvious one is to assume that information be distributed among several repositories that may be subject to external attacks. The probability of breach of each repository could be managed by an investment in security, using the same technology (that is the same parametric form of the univariate SBP function). An alternative approach is to assume that a mix of technologies could be applied to each repository.